Cyber Resilience

CVE-2026-2162

MediumPublic PoC

Published: 08 February 2026

Published
08 February 2026
Modified
10 February 2026
KEV Added
—
Patch
—
CVSS Score v4 5.1 CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0002 4.0th percentile
Risk Priority 10 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-2162 is a medium-severity Injection (CWE-74) vulnerability in Clive 21 News Portal Project. Its CVSS base score is 5.1 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 4.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and AC-6 (Least Privilege).

Deeper analysis

CVE-2026-2162 is a SQL injection vulnerability (CWE-74, CWE-89) in the itsourcecode News Portal Project version 1.0. The flaw affects an unknown part of the file /admin/aboutus.php, where manipulation of the pagetitle argument triggers the injection. Published on 2026-02-08, it carries a CVSS v3.1 base score of 4.7 (AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L).

The vulnerability is remotely exploitable over the network with low attack complexity but requires high privileges, such as administrative access. Attackers can achieve low-level impacts on confidentiality, integrity, and availability through SQL injection, potentially allowing limited data exposure, modification, or disruption. The exploit has been publicly disclosed and may be utilized.

Advisories and details are available via VulDB entries (https://vuldb.com/?ctiid.344864, https://vuldb.com/?id.344864, https://vuldb.com/?submit.751083), a GitHub issue (https://github.com/Wzl731/test/issues/2), and the vendor site (https://itsourcecode.com/). No specific patches or mitigations are detailed in the CVE description.

EU & UK References

Vulnerability details

A vulnerability was determined in itsourcecode News Portal Project 1.0. This affects an unknown part of the file /admin/aboutus.php. This manipulation of the argument pagetitle causes sql injection. The attack may be initiated remotely. The exploit has been publicly disclosed…

more

and may be utilized.

CWE(s)
CWE-74CWE-89

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

SQL injection in web app admin interface directly enables exploitation of the application for limited data access/modification (T1190).

Confidence: MEDIUM · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-3134Same product: Clive 21 News Portal Project
CVE-2026-3135Same product: Clive 21 News Portal Project
CVE-2026-3164Same product: Clive 21 News Portal Project
CVE-2026-2225Same product: Clive 21 News Portal Project
CVE-2026-1688Same vendor: Clive 21
CVE-2026-2161Same vendor: Clive 21
CVE-2026-3150Shared CWE-74, CWE-89
CVE-2026-3746Shared CWE-74, CWE-89
CVE-2025-2683Shared CWE-74, CWE-89
CVE-2026-5238Shared CWE-74, CWE-89

Affected Assets

clive 21
news portal project
1.0

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation and sanitization of untrusted input (pagetitle) before it reaches SQL statements in /admin/aboutus.php.

AC-6 Least Privilege partial match
prevent

Restricts the high-privilege accounts needed to reach the vulnerable admin page, reducing the population that can exploit the injection.

SI-2 Flaw Remediation partial match
prevent

Mandates timely remediation of the known SQL injection flaw in the News Portal application code.

References